The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade lcms2 | Aug 30, 2017 | Feb 3, 2017 |
| Azul Zulu | — | Apply Azul Zulu JDK 9 installer 9.0.1 (JDK 9.0.1, PSU) (short-term support); migrate to JDK 11 (LTS)Apply legacy security update: Azul Zulu JDK 7 installer 7.21 (JDK 7u161, quarterly CPU) — Azul Legacy Production SupportUpgrade to Azul Zulu JDK 8 installer 8.25 (JDK 8u152, quarterly CPU) (LTS stream) | Feb 3, 2017 | Feb 3, 2017 |
| Centos_linux | — | Upgrade satellite-brandingUpgrade java-1.8.0-ibm-srcUpgrade java-1.7.1-ibm-srcUpgrade java-1.7.1-ibmUpgrade java-1.7.1-ibm-demoUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.8.0-ibm-develUpgrade java-1.7.1-ibm-jdbcUpgrade satelliteUpgrade java-1.8.0-ibm-pluginUpgrade java-1.7.1-ibm-pluginUpgrade java-1.7.1-ibm-develUpgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibm | Oct 19, 2017 | Nov 12, 2016 |
| Debian | — | Upgrade lcms2 | Jan 30, 2017 | Jan 29, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade lcms2 | Dec 4, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade lcms2 | Dec 18, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade lcms2 | Nov 19, 2019 | Feb 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for java_oct2017_advisory | Dec 8, 2017 | Dec 7, 2017 |
| Ibm Java | — | Upgrade IBM Java to version 7.1.4.15Upgrade IBM Java to version 8.0.5.5Upgrade IBM Java to version 7.0.10.15 | Oct 5, 2018 | Feb 3, 2017 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 18, 2017 | Feb 3, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 3, 2017 |
| Redhat_linux | — | Upgrade java-1.7.1-ibmUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.8.0-ibmNo solution existsUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.7.1-ibm-demoUpgrade java-1.8.0-ibm-develUpgrade java-1.7.1-ibm-pluginUpgrade java-1.8.0-ibm-pluginUpgrade java-1.8.0-ibm-demoUpgrade java-1.7.1-ibm-srcUpgrade java-1.7.1-ibm-develUpgrade java-1.8.0-ibm-src | Feb 3, 2017 | Jan 29, 2017 |
| Suse | — | Upgrade java-1_8_0-ibmUpgrade java-1_7_0-ibm-pluginUpgrade liblcms2-2-32bitUpgrade java-1_7_0-ibm-alsaUpgrade liblcms2-develUpgrade java-1_8_0-openjdkUpgrade lcms2Upgrade java-1_8_0-ibm-alsaUpgrade java-1_7_0-ibm-develUpgrade java-1_8_0-openjdk-develUpgrade java-1_7_0-openjdkUpgrade java-1_7_0-ibmUpgrade java-1_8_0-openjdk-headlessUpgrade java-1_7_0-ibm-jdbcUpgrade liblcms2-2Upgrade java-1_7_1-ibm-develUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_8_0-openjdk-demoUpgrade java-1_7_1-ibmUpgrade java-1_7_1-ibm-alsaUpgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibm-pluginUpgrade java-1_7_0-openjdk-headlessUpgrade java-1_7_1-ibm-pluginUpgrade java-1_7_0-openjdk-demoUpgrade java-1_7_0-openjdk-devel | Nov 10, 2017 | Jan 29, 2017 |
| Ubuntu | — | Upgrade liblcms2-utilsUpgrade liblcms2-2Upgrade liblcms-utilsUpgrade liblcms1 | Oct 2, 2018 | Jan 29, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub